Uncontrolled resource consumption in braces [11] #194

New issue

Closed

opened 2024-07-22 18:03:38 +01:00 by Helpdesk · 0 comments

Helpdesk commented

2024-07-22 18:03:38 +01:00

Member

Package: braces (npm)
Affected versions: < 3.0.3
Patched version: 3.0.3

The NPM package braces fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

Package: braces (npm) Affected versions: < 3.0.3 Patched version: 3.0.3 --- The NPM package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js`, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

Helpdesk added the

type

dependencies

label 2024-07-22 18:03:38 +01:00

Vylpes added this to the 2.3.0 milestone 2024-07-26 16:57:54 +01:00

Vylpes added this to the 2.3 Sprint 2 project 2024-07-26 16:58:23 +01:00

Vylpes self-assigned this 2024-07-26 16:59:06 +01:00

Vylpes removed this from the 2.3.0 milestone 2024-07-27 15:26:09 +01:00

Vylpes removed this from the 2.3 Sprint 2 project 2024-07-27 15:26:19 +01:00

Vylpes added this to the 2.4.0 milestone 2024-08-25 14:13:54 +01:00

Vylpes added this to the 2.4 Sprint 1 project 2024-09-01 14:47:38 +01:00

Vylpes started working 2024-09-06 17:18:46 +01:00

Vylpes closed this issue

2024-09-06 17:23:00 +01:00

Vylpes stopped working 2024-09-06 17:23:00 +01:00

4 minutes 14 seconds

No milestone

No project

No assignees

1 participant

Notifications

Total time spent: 4 minutes 14 seconds

Vylpes

4 minutes 14 seconds

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: RabbitLabs/random-bunny#194

No description provided.